linux-kernel - Re: [PATCH] acpi / apei: fix NULL deref during init

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20181214225428.GL11710@zn.tnic>
Date:   Fri, 14 Dec 2018 23:54:28 +0100
From:   Borislav Petkov <bp@...en8.de>
To:     Thomas Schöbel-Theuer <thomas@...oebel-theuer.de>
Cc:     Thomas Schoebel-Theuer <tst@...oebel-theuer.de>,
        linux-kernel@...r.kernel.org, Laura Abbott <labbott@...hat.com>,
        "Rafael J. Wysocki" <rjw@...ysocki.net>,
        Len Brown <lenb@...nel.org>, Tony Luck <tony.luck@...el.com>,
        linux-acpi@...r.kernel.org, stable@...r.kernel.org
Subject: Re: [PATCH] acpi / apei: fix NULL deref during init

On Fri, Dec 14, 2018 at 11:42:01PM +0100, Thomas Schöbel-Theuer wrote:
> Ah, I overlooked that commit e56c92565dfe2 is already providing a different
> solution to the same problem in newer kernels _only_, as a _side_ effect
> (not clear to me from the description, but clear from reading the code).

Damn, I missed the fact that this is not the upstream kernel:

CPU: 0 PID: 1 UID: 0 Comm: swapper/0 Not tainted 4.4.0-ui18344.004-uiabi1-infong-amd64 #1

> So another alternative would be backporting e56c92565dfe2 to the 4.4 LTS
> series. Also fine for me.

That looks like the right fix.

A note for the next time: do not send a fix for a stable kernel which is
not upstream:

>From Documentation/process/stable-kernel-rules.rst:

" - It or an equivalent fix must already exist in Linus' tree (upstream)."

The stable kernels track upstream so if a stable kernel has a problem,
the first thing one needs to do is to check whether this has been fixed
upstream and if so, to backport it. This is the case most of the time.
In the very seldom cases where a separate fix is needed, it needs to be
handled by asking Greg what to do. :-)

Adding stable@ folks to CC to set me straight if I'm missing something.

-- 
Regards/Gruss,
    Boris.

Good mailing practices for 400: avoid top-posting and trim the reply.